What's the Right Approach to State and Local Voting Security?
Elections are at the core of democracy. However, ensuring that every vote counts and that vote counts are accurate is a growing concern in the digital age.
"There are a huge number of touchpoints and intersection points for voter data and it's vital to keep it secure," says Michael Garcia, director of elections best practices for the nonprofit Center for Internet Security (CIS). "Local and state governments must acknowledge that they are at risk and manage the risk."
The concept isn't lost on most election officials. Hacks, attacks and attempts to compromise data are real. These range from incidents perpetrated by Russia in the 2016 presidential election to voter registration database breaches in Illinois and Arizona.
"Systems are increasingly under assault," says Katie Moussouris, founder and CEO of a cybersecurity advisory firm and the creator of Microsoft's Bug Bounty program.
SIGN UP: Get more news from the StateTech newsletter in your inbox every two weeks!
How to Make State and Local Election Security Count
The challenge for most local and state election officials is dealing with the array of technologies, systems and processes that add up to an election. This can include volunteers using their own computers to handle official functions, staff printing documents or uploading data into a system, and inadequate database security.
"As systems and networks become more interconnected, the risks magnify," Garcia adds. "In some cases, agencies may not know about all the devices and things that are used in the voting process."
Locking down processes and systems is no simple endeavor. A starting point, Garcia says, is to conduct a general risk assessment.
"It's critical to understand your network and your processes," he notes, adding that this assessment may involve internal staff but it's wise to consider an independent assessor. "It's impossible to address every possible vulnerability so you have to focus on mitigating the most significant risks."
According to Garcia, election security measures ultimately revolve around three types of systems: network connected systems and computers; indirectly connected systems such as external media, which includes hard drives and USB drives; and non-digital components, including paper, that intersect and connect with digital systems.
In its 74-page guide, A Handbook for Elections Infrastructure Security, CIS offers 88 ways to secure systems. Among the high-priority items, Garcia says, is to ensure that redundant systems are in place, air gaps exist between key systems, and backup sets of all data exist.
At the network IT level, key security techniques include:
- Whitelisting IP addresses authorized to access a specific device or system
- Using network scans to detect unauthorized devices
- Encrypting and digitally signing data
- Providing training to both volunteers and staff about security best practices
Localities Take Diverse Approaches to Election Security
Amid all of this, local and state officials are taking steps to improve security. For example, in Morgan County, Ala., electronic poll books, residing on iPads, allow poll workers to check in voters faster and more accurately.
"Everyone's information is contained on all the iPads in that precinct," says Morgan County Probate Judge Greg Cain.
In Rhode Island, officials are working to secure the voting process prior to the 2019 midterm elections. This includes adoption of a new audit system recommended by federal authorities.
Ohio is now considering spending $114.5 million to replace aging voting machines with more efficient and secure devices.
Indiana has begun piloting a monitoring solution that uses commodity hardware and open-source intrusion detection software to analyze network traffic. The solution spots suspicious activity based on known signatures.
Meanwhile, Georgia lawmakers are considering a bill to replace 27,000 voting machines with paper ballots that leave a clear audit trail. However, Moussouris believes that paper re-introduces other problems, including poorly marked ballots, chads, and cumbersome and inefficient processes. She says that one solution — particularly at precincts — is to use easily configurable and easily wiped devices, such as Google Chromebooks.
"This approach reduces the demands on volunteers and workers to be security experts," she notes.
One thing is clear: maintaining election integrity is an issue that won't disappear.
"From the early days of the American Revolution to the present day, it has always been crucial to recognize that security and data integrity revolve around process," Garcia explains. "Although the technology continues to evolve — and it is important to address the potential weaknesses and vulnerabilities it introduces — a framework for assessing risk, managing it and building in resiliency are at the center of everything."
